Consent creep

Agents need access to act: a calendar, an inbox, a payment card, a folder of files. The easy design asks once, broadly, at setup, and keeps the grant for good. Each new capability then inherits the old yes. Access granted to arrange meetings becomes access used to read everything the calendar touches, and nobody asked the person again because nobody had to.

Nothing is hidden at any single moment. The scope moves while the consent stands still. Withdrawing is usually harder than granting: buried in settings, all or nothing, with no clear picture of what the agent can reach.

The hard part is real. An agent’s actions, as NIST puts it, ‘might not be fully predictable when deployed’, so the narrowest scope is not always known in advance. That is an argument for asking again as the task unfolds, not for asking once for everything.

The UK Information Commissioner’s Office describes this pattern in its 2026 work on agentic AI. It warns that organisations ‘could set purposes too broadly’, that people ‘may progressively choose to open access to additional information’, and that ‘Organisations should not give agentic AI systems access to information just because it might be useful in the future.’ OWASP lists excessive agency among the top risks for applications built on language models, traces it to excessive functionality, permissions and autonomy, and recommends the narrowest permissions and a person approving high-impact actions.

The plumbing is only half built. The Model Context Protocol, through which most agents now reach tools and data, says authorisation servers ‘SHOULD issue short-lived access tokens’, but leaves how narrow a scope should be to the OAuth layer and says nothing about it. NIST’s 2026 concept paper on agent identity is a list of open questions, among them how to establish least privilege for an agent and whether its authorisation can change as its context does. Phones solved the equivalent problem years ago: since Android 11 a request for location, microphone or camera can be granted ‘Only this time’, and permissions for an app unused for a few months are reset automatically. Agents mostly ask for ‘Always’.

The law already sets the standard that consent creep falls short of. Under the EU’s GDPR, personal data must be ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes’, and ‘It shall be as easy to withdraw as to give consent.’ The European Data Protection Board’s 2026 summary makes the design implication plain: ‘Consent must be granular’, and ‘If consent was given with one click, it should be possible to withdraw it as easily.’ We know of no regulator’s case against an AI assistant for scope creep as of October 2026; the standard is written, and untested.